Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Corelight

Corelight in the Black Hat USA NOC: A playlist of attendee mistakes

Oct 9, 2026 By Mark Overholser In Corelight
When I got back from Black Hat USA, I was stunned. Of course, it’s easy to be overwhelmed by Black Hat. There is so much going on. Las Vegas casinos are loud and flashy. Going outdoors feels like standing on the surface of the sun. Everywhere you walk there are strong smells, and you hope it’s a delicious meal, but sometimes it’s not.
Read Post
Corelight

Hunting Citrix NetScaler zero-days with Corelight: Part 2

Oct 9, 2026 By Deepali Prasad In Corelight
In Hunting Citrix NetScaler zero-days with Corelight, we explored how network evidence from Corelight’s Open Network Detection and Response (NDR) Platform can help identify candidate NetScaler appliances, observe DTLS use and hunt for suspicious activity.
Read Post
Corelight

Watch what happens when your AI agent actually knows how to investigate

Sep 29, 2026 By Alyssa Ideboen In Corelight
A SOC analyst spots suspicious activity from an internal IP. They need to understand what is happening. They open their SIEM's built-in AI assistant and type: "Tell me about 192.168.0.10." The assistant checks the entity store. Nothing. The analyst rephrases: "This is in our environment. Can you please check the logs and walk me through what's going on with this device?" A moment later, the assistant returns a summary. The host is involved in Windows file sharing and remote administration.
Read Post
Corelight

Hunting Citrix NetScaler Zero-Days with Corelight

Sep 28, 2026 By Ben Reardon In Corelight
Citrix’s security bulletin CTX697096, the NetScaler security blog, and WatchTowr’s vulnerability FAQ describe an urgent situation for organizations using NetScaler ADC and NetScaler Gateway. Two vulnerabilities (CVE-2026-88771 and CVE-2026-88772) are known to be exploited. CISA confirms active exploitation globally and has added both to its Known Exploited Vulnerabilities catalog.
Read Post
Corelight

Canada Raises the Bar for Critical Infrastructure Cybersecurity. Is Your Network Ready?

Sep 25, 2026 By Eliane Guindon In Corelight
Canada has taken a significant step toward strengthening national cyber resilience. With Royal Assent now granted to Bill C-8, the Government of Canada is establishing a new framework for protecting critical cyber systems and securing the country's most essential services.
Read Post
Corelight

Investigate your network in plain English: introducing Natural Language Query

Sep 25, 2026 By Adam Pumphrey In Corelight
Every SOC analyst has been there. An alert fires. You know what you need to find. Maybe it's all outbound connections from a specific host that spiked overnight. Maybe it's every DNS query over 100 characters from a subnet you're watching. You know the question. What you don't know is the exact query syntax you need to ask it. So you open the documentation. You search for field names. You try a query, get it wrong, adjust, and try again. Minutes pass.
Read Post
Corelight

Post-Quantum Cryptography: The upgrade nobody asked for (but everyone's getting)

Sep 25, 2026 By Josh Porto In Corelight
Post-Quantum Cryptography (PQC) is the security equivalent of showing up at the airport and discovering TSA changed the rules overnight again: Laptops out, laptops in, shoes off, shoes on, and declare your shampoo like it’s contraband uranium. You can argue with the signage, but the plane is still leaving, and compliance is not optional. The good news is you don’t need a physics degree, a quantum computer, or a wellness crystal to deal with it.
Read Post
Corelight

The water system attacks were simple. Securing OT isn't.

Sep 24, 2026 By Paul Mathis, Senior Sales Engineer, Corelight In Corelight
Recent cyberattacks against U.S. water and wastewater systems have put some familiar operational technology (OT) security problems back in the headlines. Federal agencies have warned about malicious actors targeting internet-facing programmable logic controllers (PLCs), changing device configurations, and disrupting operations at utilities across multiple states.
Read Post
Corelight

Recognizing and detecting data exfiltration

Sep 18, 2026 By Tim Chiu In Corelight
Every breach that lands a CISO in front of the board has a common final act: Data leaving the building. Attackers don't get paid for breaking in. They get paid for what they take out. And by the time stolen data appears on an extortion site or in a regulator's inbox, the window to stop the damage has already closed. That is what makes exfiltration so dangerous. It rarely looks like an emergency.
Read Post

Corelight Agent Builder Library: AI Investigation Demo

Sep 18, 2026 By Corelight In Corelight
What happens when you ask a generic SIEM AI assistant and a Corelight-powered threat hunter agent the exact same question about a suspicious IP? The difference is not the model. It is the investigation expertise. In this demo, we walk through a side-by-side comparison using Elastic's agent builder. A default AI assistant returns a surface-level summary. An agent built with the Corelight Agent Builder Library identifies lateral movement, flags potential ransomware and data exfiltration, surfaces IDS alerts, maps involved hosts, and recommends next steps.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.